Cisco Router Password Recovery: 2026 Step-by-Step (ISR + Catalyst + IOS-XE)

You just inherited a Cisco router that nobody has the password for. Or the last engineer left the company. Or the lab kit you bought on eBay came with a config you can’t get into. Whatever the reason: the enable password is gone, and your only route in is through the console port and the ROM Monitor.

This guide walks the recovery step-by-step for the three device families you’ll actually see in a US networking career:

• Cisco ISR routers (ISR G2 like 2911, ISR 4000 like 4321), the console + config-register method.
• Catalyst 9200 / 9300 switches (IOS XE): interrupt the boot and set SWITCH_IGNORE_STARTUP_CFG=1. Older Catalyst 2960/3560/3750 switches use the MODE-button and flash_init method.
• IOS-XE devices generally: same principles, small differences noted.

You need three things: physical console access, a serial cable (USB-to-RJ45 rollover for older gear, USB-to-USB-C on 9200/9300), and about 15 minutes.

Legal + safety note: only do this on equipment you own or are authorized to reset. Password recovery is an intentional Cisco feature but doing it on someone else’s kit without permission is unauthorized access. If you’re an employee and there’s ANY doubt, get written authorization first.

The router recovery in nine steps

1. Console in at 9600 8-N-1.
2. Power-cycle the device.
3. During boot (first ~60 seconds), press Ctrl+Break to drop into ROMMON.
4. At rommon 1>, type confreg 0x2142. This tells the router to skip loading the saved config on next boot.
5. Type reset: the router reboots.
6. It boots WITHOUT the startup config (so no password). Type no to skip initial setup dialog.
7. enable: no password required, you’re straight in.
8. copy startup-config running-config: pull the old config into memory so you keep VLANs, interface configs, etc.
9. configure terminal, then enable secret <new-password>, then config-register 0x2102 (restores normal boot), then end, then write memory.

Reboot. Done. Old config is preserved, new password works.

Step 1: Console cable + terminal settings

Every recovery starts here. If you can’t see console output, nothing else works.

• Older ISR routers (2911, 3925, etc.): RJ45 console port, use a USB-to-RJ45 rollover cable. Any $10 Chinese clone from Amazon works.
• ISR 4000 series + Catalyst 9200/9300: USB Mini-B or USB-C console port. Standard USB cable, no rollover needed.
• Terminal software: PuTTY (Windows), Screen or Minicom (Linux), Terminal + screen (Mac). On Windows, first install the Cisco USB console driver (Silicon Labs CP210x or similar).
• Settings: 9600 baud, 8 data bits, no parity, 1 stop bit, no flow control. That’s the universal default and it hasn’t changed since the 1990s.

If you see gibberish, you’re at the wrong baud rate. If you see nothing, either the cable is dead or you’re on the wrong COM port.

Step 2: Break into ROMMON (routers)

Power-cycle the router. Watch the boot messages. Within about 60 seconds of the initial boot messages, you need to send a Break signal:

• PuTTY: Menu → Special Command → Break.
• Screen (Mac/Linux): Ctrl+A then Ctrl+B.
• Minicom: Ctrl+A then F.

If timed correctly, the router stops and shows:

rommon 1>

That’s the ROM Monitor. It’s a tiny bootloader with its own command set, enough to load IOS from Flash, change the config-register, and reset the box. Not enough for anything else.

If you miss the window, power-cycle and try again. The break has to hit during a specific phase of boot. Newer devices give you a shorter window (~10 to 15 seconds), so be ready.

Step 3: Change the config-register to 0x2142

At the rommon prompt:

rommon 1> confreg 0x2142
rommon 2> reset

0x2142 tells the router: on next boot, skip loading startup-config from NVRAM. It boots with a blank running-config, which means no enable secret, no line vty password, no console password. You’re in.

The router reboots and eventually shows:

--- System Configuration Dialog ---
Would you like to enter the initial configuration dialog? [yes/no]: no
Router>
Router> enable
Router#

No password. You’re in privileged EXEC.

Step 4: Load the old config and reset the password

Critical detail most tutorials skip: at this point the router is running BLANK config. If you just start typing new commands, you’ll lose every VLAN, every interface config, every route the previous engineer set up. You need to load the startup-config into memory first, then reset the password.

Router# copy startup-config running-config

Answer yes to the confirmation. All the previous config loads. Interfaces might come up in shutdown state (which is fine; leave them and use no shutdown where needed). Passwords are all back to what they were, but you’re already in privileged mode, so they don’t lock you out.

Now change the enable secret:

Router# configure terminal
Router(config)# enable secret MyNewSecureP@ssw0rd
Router(config)# service password-encryption

If there was also a console or VTY password, change those too:

Router(config)# line console 0
Router(config-line)#  password MyConsoleP@ss
Router(config-line)#  login
Router(config-line)# exit
Router(config)# line vty 0 4
Router(config-line)#  password MyVtyP@ss
Router(config-line)#  login

Or better, migrate VTY to SSH with local users:

Router(config)# username admin secret MyLocalP@ss
Router(config)# line vty 0 4
Router(config-line)#  login local
Router(config-line)#  transport input ssh

Step 5: Restore the config-register (this step is the one people forget)

If you skip this step, the router will boot bypassing startup-config every time it reboots, which means every power cycle wipes your work.

Router(config)# config-register 0x2102
Router(config)# end
Router# write memory

0x2102 is the normal boot config-register. write memory saves running-config to startup-config.

Verify:

Router# show version | include register
Configuration register is 0x2142 (will be 0x2102 at next reload)

If it says 0x2102 in both places, you’re good. Reboot to confirm: after the reboot, the old configuration should be intact but with your new passwords.

Catalyst 9200 / 9300 switch recovery: different procedure

Catalyst 9000 switches run IOS XE and don’t use a config-register the way routers do. Instead, you tell the boot loader to ignore the startup config for one boot (Cisco documents this in “Perform Password Recovery on Catalyst 9000 Series Switches”):

1. Connect to the console and power-cycle the switch.
2. Hold the MODE button during power-up until the switch stops at the boot loader, then release. You’ll see:

switch:

3. Tell the switch to skip the startup config, then boot:

switch: SWITCH_IGNORE_STARTUP_CFG=1
switch: boot

4. The switch boots without the old config. Type no to skip initial setup.

5. Load the old config, reset the password, and turn the ignore flag back off:

Switch> enable
Switch# copy startup-config running-config
Switch# configure terminal
Switch(config)# enable secret MyNewP@ss
Switch(config)# no system ignore startupconfig switch all
Switch(config)# end
Switch# write memory

The no system ignore startupconfig switch all line matters as much as config-register 0x2102 does on a router. Skip it and the switch ignores its saved config on every reboot.

Older Catalyst switches (2960, 3560, 3750): hold MODE while powering on, then at switch: run flash_init, rename flash:config.text flash:config.text.old and boot. After boot, rename flash:config.text.old flash:config.text, copy flash:config.text running-config, change the password and write memory.

Common mistakes

1. Trying to factory reset a device you actually just want the password reset on. Factory reset wipes everything (configs, users, certificates, licenses). Password recovery preserves it all. Two very different operations.

2. Setting config-register 0x2142 and never changing it back. The device now boots without config on every reload, including power outages. You lose reachability every time the box reboots and don’t understand why. Always config-register 0x2102 + write memory at the end.

3. Skipping copy startup-config running-config before changing the password. You reset the enable secret to something you know, save it, and reboot to find the router has no interface IPs, no OSPF, no VLANs. Because you saved a blank config over the previous one. The old configuration is still on the device in startup-config at this point, copy it into memory FIRST, then modify, THEN save.

4. Not sending Break during the right window on ISR 4000 series. Newer devices give you a much shorter Break window (~10 seconds). If Ctrl+Break during full boot doesn’t work, try power-on and immediately hold Break. Some boot loaders latch it.

5. Wrong console cable or missing driver. Serial ports need drivers. If nothing shows on the terminal, install the Silicon Labs CP210x driver (Windows) or check dmesg (Linux/Mac) for the device path. On modern Macs, USB-C hubs sometimes lose serial connections when they sleep. Try a direct USB-C cable.

6. Password recovery disabled by no service password-recovery. Some hardened deployments disable this feature at the config level. If it’s set, recovery blows away the entire startup config as a security measure. If you MUST recover a device that has no service password-recovery and you can’t afford to lose the config, contact Cisco TAC. There is no user-side workaround.

Frequently asked questions

Q: How long does Cisco password recovery take? A: 10-15 minutes if you have the console cable and physical access. The actual technical work is under 5 minutes; the rest is boot time (each router reboot takes 60-90 seconds).

Q: Do I need a Cisco TAC contract for password recovery? A: No: this is a documented feature of every Cisco IOS device, no contract or license required. TAC is only needed if no service password-recovery is set at the config level (which intentionally disables user-side recovery).

Q: Will password recovery erase my running configuration? A: Not if you do it correctly. Config-register 0x2142 tells the router to IGNORE startup-config on boot, not delete it. The saved config is preserved on NVRAM; you just have to copy it back with copy startup-config running-config after gaining access.

Q: Can I do this remotely? A: No: password recovery requires physical console access. If the device is unreachable via management and passwords are lost, someone has to physically be there with a console cable. This is intentional Cisco security design.

Q: What if the router has an encrypted password I can’t decrypt? A: Doesn’t matter: password recovery bypasses the check entirely by not loading startup-config. You never need to know or decrypt the old password; you just set a new one.

Q: Does this work on Cisco ASA firewalls? A: Similar concept but different procedure: ASAs use a service password-reset ROMMON option and a specific config-register 0x41 value. Different enough that it warrants a separate walkthrough.

Where to go from here

If you’re inheriting a rack of Cisco gear at your first NOC job and need to audit access, password recovery is one skill; the other is knowing how to lock things down so this doesn’t happen again. Two follow-ups worth reading:

• SSH + VTY access done right: how to configure login local + transport input ssh so console recovery is your only fallback, not the primary access method.
• AAA fundamentals for CCNA: external authentication (TACACS+, RADIUS) so passwords don’t live on the device at all.

Real-world practice: try this on a Cisco router in your home lab or on the free browser-based CLI console. No download, works on Chromebook or iPad. If you’re planning to break into networking in the US market, being fluent in ROMMON and password recovery is one of the small skills that separates “I have a CCNA” from “I actually know how to fix Cisco gear.” Book a free 20-minute planning call if you want a mentor to walk you through your first live recovery on real hardware.